i have the following two entries   Time Event 8/16/22 1:46:22.592 PM 2022/08/16 13:46:22.592154:P_GUI_SERV06 :pbaho3 : 98(cli) : Exit Allocate Order on portfolio list [ABC_DPM_MM_BALANCED] with all instruments (Thread:00000001197f4730) host = PBIPSG07source = /app/PBISG/aaa/current/msg/server.logsourcetype = prd-pbisg-server-logtimeendpos = 26timestartpos = 0 8/16/22 1:45:51.201 PM 2022/08/16 13:45:51.201360:P_GUI_SERV06 :pbaho3 : 98(cli) : Start Allocate Order on portfolio list [ABC_DPM_MM_BALANCED] with all instruments (Thread:00000001197f4730) host = PBIPSG07   The entry will start with an entry like 'Start Allocate Order' and end with "Exit Allocate Order"   how do i build a Splunk search to calculate the duration taken between those two event ?   Based on the above , i would like to build more complex search: notice that there is ':pbaho3:' , so there will be multiple users in this case is 'pbaho3' , so how do i group the entries by specific users ? ... View more